CVE-2026-61226: High severity Oracle Communications Oracle Communications Converged Application Server vulnerability
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: RTP Proxy). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Converged Application Server executes to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Communications Converged Application Server (RTP Proxy)to a version that resolves this vulnerability.Fixed in 8.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61226?
CVE-2026-61226 has a high severity rating of 7.5.
How do I fix CVE-2026-61226?
To mitigate CVE-2026-61226, apply the latest security patch provided by Oracle for the affected version 8.3.
What systems are affected by CVE-2026-61226?
CVE-2026-61226 affects the Oracle Communications Converged Application Server version 8.3.
What is the risk associated with exploiting CVE-2026-61226?
The risk associated with CVE-2026-61226 is that a high privileged attacker could gain unauthorized access to critical infrastructure.
When was CVE-2026-61226 published?
CVE-2026-61226 was published on July 21, 2026.